Merge pull request #683 from artichoke/dev/lopopolo-zizmor-template-i…

…njection

Fix template injection in code coverage action

github-org-artichoke/templates/rust-code-coverage.yaml

@@ -20,10 +20,12 @@ jobs:
       CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
     steps:
       - name: Checkout repository
-        uses: actions/[email protected]
+        uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Install nightly Rust toolchain
-        uses: artichoke/setup-rust/code-coverage@v1.9.0
+        uses: artichoke/setup-rust/code-coverage@v1.12.1
 
       - name: Setup grcov
         run: |
@@ -61,7 +63,7 @@ jobs:
         run: grcov ${github_repository}*.profraw --source-dir . --keep-only 'src/**/*.rs' --binary-path target/debug -t covdir --filter covered -o target/coverage/coverage.json
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2.0.0
+        uses: aws-actions/configure-aws-credentials@4fc4975a852c8cd99761e2de1f4ba73402e44dd9 # v4.0.3
         if: github.ref == 'refs/heads/trunk'
         with:
           aws-region: us-west-2
@@ -82,8 +84,13 @@ jobs:
 
       - name: Check missed lines
         shell: python
+        env:
+          GITHUB_REF_NAME: $${{ github.ref_name }}
+          GITHUB_EVENT_NAME: $${{ github.event_name }}
+          GITHUB_EVENT_NUMBER: $${{ github.event.number }}
         run: |
           import json
+          import os
           from urllib.request import urlopen
 
           trunk_coverage_url = "https://codecov.artichokeruby.org/${github_repository}/coverage.json"
@@ -101,7 +108,7 @@ jobs:
               print("")
 
 
-          if "$${{ github.ref_name }}" == "trunk":
+          if os.environ.get("GITHUB_REF_NAME") == "trunk":
               # We don't need to compare trunk coverage to itself
               exit(0)
 
@@ -114,8 +121,8 @@ jobs:
               branch_coverage = json.load(local)
 
           on = None
-          if "$${{ github.event_name }}" == "pull_request":
-              on = "PR artichoke/${github_repository}#$${{ github.event.number }}"
+          if os.environ.get("GITHUB_EVENT_NAME") == "pull_request":
+              on = "PR artichoke/${github_repository}#" + os.environ.get("GITHUB_EVENT_NUMBER")
 
           print_report(branch_coverage, on=on)